Splunk Search

Difference of values ​​using single value with percentage

leandromatperei
Path Finder

I would like to put together a graph with the difference of values ​​as a percentage, so I can use the single value and if it is above 70% it would turn red.

 

 

 

index="teste" "ProcessInboundEmail" | timechart span=10m dc(id_email) as ProcessInboundEmail
| appendcols  [search index="teste""submitInboundEmail" ended | timechart span=10m dc(id_email) as submitInboundEmail]
| eval diff =  ProcessInboundEmail - submitInboundEmail | eval diff=if(ProcessInboundEmail< submitInboundEmail, diff * -1, diff)

 

 

 

 

can you help me?

 

Labels (1)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

index="teste" "ProcessInboundEmail" | timechart span=10m dc(id_email) as ProcessInboundEmail
| appendcols [search index="teste""submitInboundEmail" ended | timechart span=10m dc(id_email) as submitInboundEmail]
| eval perc = round(abs(ProcessInboundEmail - submitInboundEmail)/(ProcessInboundEmail + submitInboundEmail)*100,2) | table _time perc

 

and modify FORMAT

View solution in original post

0 Karma

to4kawa
Ultra Champion

index="teste" "ProcessInboundEmail" | timechart span=10m dc(id_email) as ProcessInboundEmail
| appendcols [search index="teste""submitInboundEmail" ended | timechart span=10m dc(id_email) as submitInboundEmail]
| eval perc = round(abs(ProcessInboundEmail - submitInboundEmail)/(ProcessInboundEmail + submitInboundEmail)*100,2) | table _time perc

 

and modify FORMAT

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...